LukaCodes

<p><strong>AntiSpam Shield by LukaCodes</strong> is a lightweight, no-bloat plugin that protects your WordPress comment section <strong>and contact forms</strong> from spam. Six independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.</p>
<ul>
<li><strong>Disable Website Field</strong> — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li><strong>Strip Links from Comments</strong> — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li><strong>reCAPTCHA v3</strong> — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li><strong>Cloudflare Turnstile</strong> — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li><strong>Login Shield</strong> — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li><strong>Registration Shield</strong> — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li><strong>WPForms Integration</strong> — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
<li><strong>Easy Contact Form by LukaCodes Integration</strong> — Apply the same CAPTCHA protection to forms created with the companion Easy Contact Form plugin.</li>
</ul>
<p>All features are <strong>independent</strong> — enable only what you need.</p>
<h4>Login & Registration Shield</h4>
<p>Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:</p>
<ul>
<li><strong>Login Shield</strong> — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li><strong>Registration Shield</strong> — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
<p>Both are independently togglable in the settings panel. Admins already logged in are never affected.</p>
<h4>WPForms Integration</h4>
<p>Version 1.1.0 introduces CAPTCHA protection for <strong>WPForms Lite</strong>:</p>
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
<p>Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for <strong>WPForms Lite</strong> users only.</p>
<h4>Easy Contact Form by LukaCodes Integration</h4>
<p>Version 1.1.4 adds CAPTCHA protection for forms created with <a href="https://wordpress.org/plugins/lukacodes-easy-contact-form/" rel="ugc">Easy Contact Form by LukaCodes</a>:</p>
<ul>
<li>Injects the CAPTCHA widget (Turnstile) or invisible token (reCAPTCHA v3) into every Easy Contact Form on the page.</li>
<li>Hooks into Easy Contact Form’s <code>lukacodes_comment_shield_check</code> filter for server-side token verification before the submission is processed or emails are sent.</li>
<li>Uses the same CAPTCHA keys you already configured — no extra setup.</li>
<li>When a token fails, the user sees a CAPTCHA-specific error message inline; the submission is never stored or emailed.</li>
</ul>
<h4>Why AntiSpam Shield?</h4>
<p>Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. AntiSpam Shield by LukaCodes is different:</p>
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with <strong>live key testing</strong> — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li><strong>Link stripping preview</strong> — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li><strong>Mutual exclusion</strong>: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
<p>When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.</p>
<h4>Cloudflare Turnstile — How it works</h4>
<p>A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.</p>
<h3>Third-Party Services</h3>
<p>This plugin optionally uses the following third-party services:</p>
<h4>Google reCAPTCHA v3</h4>
<p>A service provided by Google LLC.</p>
<ul>
<li><strong>What it does:</strong> Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li><strong>When data is sent:</strong> Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li><strong>What data is sent:</strong> The visitor’s IP address and a reCAPTCHA token.</li>
<li><strong>Google Privacy Policy:</strong> https://policies.google.com/privacy</li>
<li><strong>Google Terms of Service:</strong> https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<p>A service provided by Cloudflare, Inc.</p>
<ul>
<li><strong>What it does:</strong> Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li><strong>When data is sent:</strong> Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li><strong>What data is sent:</strong> The visitor’s IP address and a Turnstile token.</li>
<li><strong>Cloudflare Privacy Policy:</strong> https://www.cloudflare.com/privacypolicy/</li>
<li><strong>Cloudflare Terms of Service:</strong> https://www.cloudflare.com/website-terms/</li>
</ul>
<p>Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.</p>


AntiSpam Shield by LukaCodes

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

Md Taufiqur Rahman

realitsolution

<p><strong>RIS Cloudflare CAPTCHA</strong> adds the modern, privacy-first <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a> CAPTCHA to your WordPress site. Stop bots, spam comments, and brute-force login attacks without annoying your visitors with image puzzles or Google reCAPTCHA.</p>
<p>Unlike legacy CAPTCHAs, Cloudflare Turnstile runs completely in the background, never asks visitors to click traffic lights or type distorted text, and protects visitor privacy.</p>
<h4>Why Choose RIS Cloudflare CAPTCHA?</h4>
<ul>
<li><strong>Privacy-friendly</strong> – No user tracking, no cookies, no personal data collection.</li>
<li><strong>User-friendly</strong> – Most visitors never see a challenge; it’s invisible by default.</li>
<li><strong>Lightweight</strong> – Tiny footprint, no external dependencies, no bloated JS bundles.</li>
<li><strong>Free</strong> – Powered by Cloudflare Turnstile, which is 100% free for unlimited use.</li>
<li><strong>Universal</strong> – Protects WordPress login, registration, comment, lost-password, and WPForms.</li>
<li><strong>Developer-friendly</strong> – Shortcode, PHP function, and a verification filter for custom forms.</li>
<li><strong>Multilingual</strong> – Supports 11 widget languages including English, Spanish, French, German, Bengali, Hindi, Arabic, Chinese, Japanese, and more.</li>
<li><strong>Customizable</strong> – Light, dark, or auto theme; visible, invisible, or interaction-only mode.</li>
</ul>
<h4>Features</h4>
<ul>
<li>Drop-in Turnstile widget on:
<ul>
<li>WordPress login form</li>
<li>WordPress registration form</li>
<li>WordPress lost password form</li>
<li>WordPress comment form</li>
<li>WPForms (all forms)</li>
</ul>
</li>
<li>Server-side token verification for every form (not just client-side).</li>
<li>Secure nonce checks on every form submission.</li>
<li><strong>Test Connection</strong> button to instantly verify your API keys.</li>
<li>Per-form enable/disable checkboxes.</li>
<li>Light, dark, or auto theme matching.</li>
<li>Visible, invisible (“execute”), or interaction-only appearance.</li>
<li>Custom widget language selection.</li>
<li>Tabbed admin settings page (Settings / Help / About).</li>
<li>Shortcode: <code>[ris_turnstile action="contact"]</code> for custom forms.</li>
<li>Developer filter: <code>ris_cf_captcha_verify_response</code> for custom verification.</li>
<li>Full uninstall cleanup (deletes all options on plugin removal).</li>
<li>Multisite compatible.</li>
<li>Translation ready (.pot, /languages folder).</li>
<li>Proper WordPress coding standards, sanitization, escaping, and capability checks.</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and activate the plugin.</li>
<li>Get free Turnstile keys from your <a href="https://dash.cloudflare.com/?to=/:account/turnstile" rel="nofollow ugc">Cloudflare Dashboard</a>.</li>
<li>Paste your Site Key and Secret Key into the plugin settings.</li>
<li>Tick the forms you want to protect.</li>
<li>Save. Done.</li>
</ol>
<h4>Shortcode</h4>
<p>Use the widget on any page or custom form:</p>
<pre><code>[ris_turnstile action="contact"]
</code></pre>
<p>Or in PHP:</p>
<pre><code><?php echo do_shortcode( '[ris_turnstile]' ); ?>
</code></pre>
<h4>Custom Form Verification (Developers)</h4>
<p>Hook into the verification filter:</p>
<pre><code>add_filter( 'ris_cf_captcha_verify_response', function( $is_valid, $token, $ip ) {
 // Your custom checks here.
 return $is_valid;
}, 10, 3 );
</code></pre>
<h4>Privacy</h4>
<p>This plugin:<br />
* Does <strong>not</strong> set any cookies.<br />
* Does <strong>not</strong> track users.<br />
* Does <strong>not</strong> store any personal data.<br />
* Sends the visitor’s IP address to Cloudflare only for the verification request, as required by the Turnstile API.<br />
* Does <strong>not</strong> send any data to any third party other than Cloudflare.</p>
<p>GDPR, CCPA, and privacy-law friendly.</p>
<h4>Related Plugins</h4>
<ul>
<li>Real IT Solution – <a href="https://www.realitsolution.com/" rel="nofollow ugc">https://www.realitsolution.com/</a></li>
</ul>
<h3>Credits</h3>
<ul>
<li>Developed by <a href="https://www.realitsolution.com/" rel="nofollow ugc">Real IT Solution</a> – Md Taufiqur Rahman.</li>
<li>Powered by <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">Cloudflare Turnstile</a>.</li>
<li>Icons by <a href="https://developer.wordpress.org/resource/dashicons/" rel="nofollow ugc">WordPress Dashicons</a>.</li>
</ul>
<h3>Support</h3>
<ul>
<li>Documentation: <a href="https://wordpress.org/plugins/ris-cloudflare-captcha/" rel="ugc">https://wordpress.org/plugins/ris-cloudflare-captcha/</a></li>
<li>Support forum: <a href="https://wordpress.org/support/plugin/ris-cloudflare-captcha/" rel="ugc">https://wordpress.org/support/plugin/ris-cloudflare-captcha/</a></li>
<li>Author website: <a href="https://www.realitsolution.com/" rel="nofollow ugc">https://www.realitsolution.com/</a></li>
</ul>


RIS Cloudflare CAPTCHA – Cloudflare Turnstile

Privacy-friendly Cloudflare Turnstile CAPTCHA for WordPress login, registration, comments & WPForms. Stops bots and spam.

AntiSpam Shield by LukaCodes vs RIS Cloudflare CAPTCHA – Cloudflare Turnstile